Your Team Is Already Using AI: A One-Page AI Use Policy for Small Businesses

Somebody in your office has probably already pasted something into a chatbot this week. Maybe it was a front-desk coordinator rewording a tricky patient email, a staff accountant summarizing a client's notes, or an office manager drafting a job posting. Most of the time that's harmless and genuinely helpful. Sometimes the thing they pasted was a client's tax return, a patient's chart note, or the details of a pending legal matter.

You don't fix that by banning AI. People will keep using it on their phones, and you'll lose the time savings that made them reach for it in the first place. You fix it with a short, clear policy that tells your team what's fine, what isn't, and which tools to use.

This guide walks through a one-page AI use policy that a small business in Jacksonville, Orlando or anywhere in Florida can write in an afternoon.

Why a small business needs an AI policy now

Large companies have legal and IT teams writing long AI governance documents. A 12-person dental office or a 6-person CPA firm doesn't need that. It does need answers to a few questions, because the risks are real even at small scale:

• Client and patient data can leave your control. Free consumer AI tools may keep what you type, and their terms can allow it to be used to improve their models. Business plans usually offer stronger data commitments, but you have to choose them on purpose.
• Professional obligations still apply. Healthcare privacy rules, confidentiality duties for attorneys and accountants, and your own client contracts don't have an exception for "I asked a chatbot."
• AI output can be confidently wrong. A made-up citation in a legal letter or a wrong number in a client email is still your mistake.
• Nobody knows what's allowed. Without guidance, careful employees avoid useful tools while less careful ones use whatever they like.

A short policy turns those risks into a few simple rules people can actually remember.

What goes in a one-page AI use policy

Keep it to one page. If it's longer, nobody will read it. Here's a structure that works for most small offices.

1. Purpose, in one sentence

Say why the policy exists in plain words. For example: "We use AI tools to save time on routine writing and research, and we protect client information while we do it."

2. Approved tools

List the specific AI tools your team may use for work, and which account to use. This is the most important line in the whole policy.

• Name the tool and the plan (for example, a business or team plan that your company pays for and manages).
• Say who has accounts and who manages them.
• Say that personal and free accounts are not for client work.

If you use Microsoft 365 or Google Workspace, check what AI features are already included in your subscription and what data terms apply before you buy anything new.

3. What data can and can't go in

Sort your information into three simple buckets:

• Green: fine to use. Public information, your own marketing copy, general questions, templates with no client details.
• Yellow: approved tools only, with care. Internal documents, de-identified examples, drafts that a person will review.
• Red: never, unless a specific workflow has been approved. Patient health information, Social Security numbers, bank and card numbers, tax returns, legal case details, passwords, and anything a client contract says to keep confidential.

Give two or three examples from your own business in each bucket. A dental office's examples will look different from a law firm's, and real examples are what make the rules stick.

4. A person reviews before it goes out

Anything AI helps write that goes to a client, patient, court, lender or regulator gets read by a person first. That person owns it. Make this a rule, not a suggestion.

5. Be honest about AI use

Decide when you'll tell clients that AI helped. At a minimum, never let an AI tool pretend to be a person in a conversation with a customer, and never present AI output as a professional opinion that a licensed person didn't review.

6. Security basics for AI accounts

• Turn on multi-factor sign-in for every AI account.
• Use company-managed accounts so access ends when someone leaves.
• Don't connect AI tools to your email, files or practice software without approval from the owner or whoever manages IT.
• Watch for AI-themed scams: fake "AI assistant" browser extensions, and phishing messages that sound unusually polished.

7. Who to ask, and what to do if something goes wrong

Name one person employees can ask ("Is this okay to paste?"). Then say what to do if someone puts red-bucket data into the wrong tool: tell that person right away, without fear of blame, so you can assess it quickly. A policy that punishes honest mistakes teaches people to hide them.

8. Review date

AI tools change fast. Put a date on the policy and review it every six months.

A sample one-page policy

Here's an example you can adapt. Replace the bracketed parts with your own details, and have your attorney review it before you adopt it. (This is an example, not legal advice.)

[Business name] AI Use Policy (effective [date], review by [date])

We use AI tools to save time on routine work, and we protect client information while we do it.

Approved tools: [Tool and plan], using company accounts only. Personal or free AI accounts are not for client work.

Never enter: patient or client health information, Social Security numbers, financial account numbers, tax documents, legal matter details, passwords, or anything a client asked us to keep confidential, unless it's part of a workflow [owner name] has approved.

Always: a person reviews anything AI helped write before it goes to a client, patient or outside party. You are responsible for what you send.

Be honest: AI never pretends to be a person when talking with clients.

Security: multi-factor sign-in on every AI account. Don't connect AI tools to email, files or business software without approval.

Questions or mistakes: ask [name]. If sensitive data goes into the wrong tool, tell [name] right away. Reporting quickly matters more than the mistake.

Rolling it out without slowing your team down

A policy only works if people use it. A simple rollout:

1. Ask before you write. Spend ten minutes asking staff which AI tools they already use and for what. You'll learn where the time savings are and where the risk is.
2. Pick approved tools first. If the policy says "use the approved tool" but there isn't one, people will keep using free accounts.
3. Walk through it in a short team meeting. Go over the green, yellow and red examples. Answer questions.
4. Have everyone sign or acknowledge it. Keep a copy with your other office policies.
5. Revisit it in six months, or sooner if you adopt a new tool or a new workflow.

Where a policy fits with real automation

A use policy covers everyday, ad-hoc use of AI. It's also the foundation for doing more. Once your team knows the rules, you can pick one workflow, such as appointment reminders, client document intake or missed-call follow-up, set it up properly with approved tools and clear data handling, and measure whether it saves enough time to justify its cost.

If you want a structured way to think about AI risk beyond a one-page policy, the U.S. National Institute of Standards and Technology publishes a free AI Risk Management Framework. It's written for organizations of all sizes, and it's a good reference when your use of AI grows.

Where we can help

We help small businesses in Jacksonville, Orlando and across Florida use AI safely and prove that it's worth what it costs. That can mean helping you choose approved tools, writing a practical policy with your team's real examples, reviewing how client data flows through your software, or setting up your first automated workflow with a clear before-and-after measurement.

Want a second opinion on where you stand? Take our free assessment at rsoftware.net/assessment or email us at hello@rsoftware.net.

For more practical guides on secure AI, automation, and security for local businesses, follow R Software & Consulting on LinkedIn.

FAQ

Should we just ban AI at work?

Usually not. Bans tend to push use onto personal phones and free accounts, where you have the least control. Approving a specific tool and setting clear data rules gives you more protection than a ban that people quietly ignore.

Are business AI plans safe for client data?

They're generally safer than free consumer accounts, because many offer commitments about data retention and model training. Read the specific terms for the plan you choose, and for regulated data such as patient health information, confirm whether the vendor will sign the agreements your rules require before using it.

Do we need a lawyer to write this?

You can draft a one-page policy yourself, but have your attorney review it, especially if you handle health, financial or legal information. They can make sure it fits your professional obligations and client contracts.

How do we know if people are following it?

Start with honesty rather than monitoring: ask, train, and make it safe to report mistakes. Company-managed accounts also let you see who has access and remove it when someone leaves.

What's the first step?

Ask your team which AI tools they use today and what they use them for. That short conversation tells you which tools to approve and which examples belong in your green, yellow and red buckets.

Written with help from our AI assistant.